Bug 1197235

Increased buffer size in upstream commit 1069.

I did a simple test to check ausearch time parsing for all possible locales:

# to list broken locales
for L in $(locale -a); do
  export LANG=$L; 
  D=$(date "+%x"); 
  T=$(date "+%X"); 
  auditctl -m "$L"; 
  sleep 1; 
  ausearch -r -ts $D $T -m USER >/dev/null 2>&1 || echo "$L|$D|$T|$(date)|"; 
  # moreover it is necessary to check that only a single event is found
done; 
 
First of all, ja_JP.UTF8 is definitely fixed now. But for quite a few other locales ausearch does not parse time correctly. From 735 locales, 219 seem to have issues. From what I see time looks strange in many cases. For instance:

# export LANG=mt_MT.iso88593
# date
Tli Mar 22 12:15:05 CET 2016
# date "+%x"
it-Tlieta, 22 ta Mar, 2016
# date "+%X"
12:15:04  CET

Clearly CET in local time is not expected. This kind of errors is most likely glibc bug. But there are other cases where everything looks perfectly fine but ausearch still will not parse it correctly:

# export LANG=sl_SI
# date 
tor mar 22 12:16:54 CET 2016
# date "+%x"
22. 03. 2016
# date "+%X"
12:16:53

in this case ausearch cannot parse date:

# ausearch -r -ts 22. 03. 2016 12:16:53   
Invalid start date (22.). Month, Day, and Year are required.

The list of all broken locales can is attached to this bugzilla, format of the file is as follows:

$LANG|$(date "+%x")|$(date "+%X")|$(date)

I consider this bug to be verified but we should think about other issues in the future, I will open a bug to track them.

Created attachment 1139043 [details]
The list of locales for which ausearch does not parse time

Thanks for testing. A new bug is not needed. There is already bug #1286633 that this exact problem was reported on. You might just attach the findings as a reminder.

In looking at the case of LANG=sl_SI above, the issue is the spaces. If you do this:

ausearch --start '22. 03. 2016' 14:00:00

It works fine. The time and date values need quoting so that its understood to be one argument to --start rather than 3. I wonder if that would clear up more of the test cases?

# ausearch --start "`date "+%x"`" "`date "+%X"`"

Clearly, you are right Steve, with quoting the number of problematic locales decreases to 141. Moreover, 117 of them are "CET" (in time) issues mentioned above. I will update BZ#1286633.

Regarding verification of this bug - successfully reproduced and verified:

OLD (audit-2.3.7-5.el6)
=======================
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: LANG ja_JP.UTF8
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   PASS   ] :: Export LANG as ja_JP.UTF8 (Expected 0, got 0)
:: [   PASS   ] :: Audit user message (Expected 0, got 0)
:: [   FAIL   ] :: Searching audit log (Expected 0, got 1)
:: [   PASS   ] :: Single event should be reported (Assert: '1' should equal '1')
:: [   FAIL   ] :: File '/var/tmp/tmp.uKMlTUWRtD' should contain 'msg='ja_JP.UTF8' 
:: [   FAIL   ] :: File '/var/tmp/tmp.uKMlTUWRtD' should not contain 'Invalid start time' 
:: [ 15:37:22 ] :: T="15時37分19秒" D="2016年03月23日"
:: [ 15:37:22 ] :: date="2016年  3月 23日 水曜日 15:37:22 CET"

# ausearch -r -m USER -ts "2016年03月23日" "15時37分19秒"'
Invalid start time (15時37分19秒). Hour, Minute, and Second are required.

New (audit-2.4.5-2.el6)
=======================
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: LANG ja_JP.UTF8
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   PASS   ] :: Export LANG as ja_JP.UTF8 (Expected 0, got 0)
:: [   PASS   ] :: Audit user message (Expected 0, got 0)
:: [   PASS   ] :: Searching audit log (Expected 0, got 0)
:: [   PASS   ] :: Single event should be reported (Assert: '1' should equal '1')
:: [   PASS   ] :: File '/var/tmp/tmp.XIRzh2fMYX' should contain 'msg='ja_JP.UTF8' 
:: [   PASS   ] :: File '/var/tmp/tmp.XIRzh2fMYX' should not contain 'Invalid start time' 
:: [ 15:32:19 ] :: T="15時32分17秒" D="2016年03月23日"
:: [ 15:32:19 ] :: date="2016年  3月 23日 水曜日 15:32:19 CET"

# ausearch -r -m USER -ts "2016年03月23日" "15時32分17秒"'
type=USER msg=audit(1458743537.177:36681): user pid=23217 uid=0 auid=0 ses=2077 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='ja_JP.UTF8 exe="/sbin/auditctl" hostname=? addr=? terminal=pts/3 res=success'

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0867.html